Get the parameters of an elliptic curve's equation

Question

I have a binary signed with ECDSA384 and I need to verify it using a particular cryptography library.

The first thing that needs to be done is to initialize the EC public key, which involves setting several parameters 'manually'. These parameters are the ones that make the following EC equation:

Elliptic Curve equation over $\operatorname{GF}(p): y^2=x^3+ax+b \pmod{p}.$

I need the parameters $a$, $b$, $p$ and $n$. (no idea what $n$ is)

The key I'm using is in PEM format. I'm aware that the EC parameters can be extracted by doing:

openssl ec -in ec384.pem -noout -text

and I get

read EC key
Private-Key: (384 bit)
priv:
    5d:b1:ef:88:fe:7b:f2:af:d8:cc:3a:04:89:09:34:
    15:c4:17:7b:41:72:ee:32:7b:54:9a:e2:aa:fa:1d:
    d1:47:1a:ef:fe:dc:d3:6b:51:fa:bd:c2:5e:66:c4:
    42:d0:16
pub:
    04:5e:ff:47:19:80:be:93:5f:8f:51:14:45:d5:40:
    41:79:ca:48:be:85:97:bd:e2:0f:2b:a0:b2:7d:6c:
    37:74:39:44:ff:50:67:74:30:a8:10:ac:89:a6:6a:
    80:5a:1a:c9:82:ff:2a:51:84:38:c8:f6:af:e0:46:
    e7:9f:d5:66:1b:20:75:7f:87:42:46:d9:6e:12:4f:
    74:38:4d:f4:9f:b1:13:27:9a:10:a8:0c:6b:4b:1f:
    f6:6c:bf:32:ee:a3:10
ASN1 OID: secp384r1
NIST CURVE: P-384

Still, I don't get the parameters I need from that output. It's not very clear to me if these parameters change from key to key or they are inherent to the curve being used, in my case, P-384.

How can I get the parameters I need?

EDIT - might help

Apart from the fantastic answers, I have found this that might help:

The python library ecpy contains this information, e.g:

pip3 install ecpy
python3
>>> import ecpy.curves as ec
>>> ec.Curve.get_curve_names()
['stark256', 'frp256v1', 'secp521r1', 'secp384r1', ...]
>>> p384 = ec.Curve.get_curve('secp384r1')
>>> hex(p384.a)
'0xffff...ffc'
>>> hex(p384.b)
'0xb3312f...3ec2aef'
>>> hex(p384.order)
'0xfffffff...cc52973'
>>> hex(p384.field)  # This is the modulus
'0xfffffff...00ffffffff'

Answer 1

04 indicates the uncompressed form of the public key.

The first half is the $x$-coordinate and the second half is the $y$-coordinate of the public key.

x= 5e:ff:47:19:80:be:93:5f:8f:51:14:45:d5:
   40:41:79:ca:48:be:85:97:bd:e2:0f:2b:a0:
   b2:7d:6c:37:74:39:44:ff:50:67:74:30:a8:
   10:ac:89:a6:6a:80:5a:1a:c9:

y =82:ff:2a:51:84:38:c8:f6:af:e0:46:e7:9f:
   d5:66:1b:20:75:7f:87:42:46:d9:6e:12:4f:
   74:38:4d:f4:9f:b1:13:27:9a:10:a8:0c:6b:
   4b:1f:f6:6c:bf:32:ee:a3:10

The parameters you are looking for are defined in the last part.

ASN1 OID: secp384r1
NIST CURVE: P-384

The parameters can be found in FIPS PUB 186-4 or SEC 2: Recommended Elliptic Curve Domain Parameters as sextuple

$$T = (p, a, b, G, n, h)$$

p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 
    FFFFFFFF FFFFFFFE FFFFFFFF 00000000 00000000 FFFFFFFF

$$ p = 2^{384} − 2^{128} − 2^{96} + 2^{32} − 1$$

The curve $E: y^2 = x^3 + ax + b$ over $F_p$ is defined $b$;

a = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    FFFFFFFF FFFFFFFE FFFFFFFF 00000000 00000000 FFFFFFFC

b = B3312FA7 E23EE7E4 988E056B E3F82D19 181D9C6E FE814112
    0314088F 5013875A C656398D 8A2ED19D 2A85C8ED D3EC2AEF

The basepoint $G$ in compressed form (03) indicates

G = 03 AA87CA22 BE8B0537 8EB1C71E F320AD74 6E1D3B62 8BA79B98
       59F741E0 82542A38 5502F25D BF55296C 3A545E38 72760AB7

The basepoint $G$ in uncompressed form (04) indicates

G = 04 AA87CA22 BE8B0537 8EB1C71E F320AD74 6E1D3B62 8BA79B98
       59F741E0 82542A38 5502F25D BF55296C 3A545E38 72760AB7
       3617DE4A 96262C6F 5D9E98BF 9292DC29 F8F41DBD 289A147C
       E9DA3113 B5F0B8C0 0A60B1CE 1D7E819D 7A431D7C 90EA0E5F

$n$ is the order of the basepoint $G$

n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
    C7634D81 F4372DDF 581A0DB2 48B0A77A ECEC196A CCC52973

and the cofactor $h$ is:

h = 01

The cofactor is caluclated by $$h = \frac{|E(\mathbb{F_p})|}{n}$$

---

Printing via OpenSSL

Using OpenSSL Command-Line Elliptic Curve Operations it is possible to print the values, too

openssl ecparam -name secp384r1 -out secp384r1.pem
openssl ecparam -in secp384r1.pem -text -param_enc explicit -noout

---

The compression

The 0x02 or 0x03 indicates the distinction of $Y$ or $-Y$. Since in the elliptic curve $$Y^2 = X^3 + aX + b$$ if $(X,Y)$ is a point then $(X,-Y)$ is also a point on the curve. This is due to the square of $Y$ in the elliptic curve equation.

The distinction designed by the least significant bit of $Y$, 0x02 for 0, and 0x03 for 1.

Answer 2

ASN1 OID: secp384r1
NIST CURVE: P-384

These parameters are so called named parameters and they specify the used parameters fully. They don't change per key. The Sec 1 curves have initially been specified, named and registered by Certicom.

Missing from above specification is the OID:

• Long form ASN.1 OID: {iso(1) identified-organization(3) certicom(132) curve(0) ansip384r1(34)};
• Short form dot-notation: 1.3.132.0.34.

Then they have been standardized by ANSI X9.62 (payware) and by NIST special publication 186-4: Digital Signature Standard (DSS) section D.1.2.4. Note that this latter document may be superseeded by 186-5 - currently in draft - but that won't change the name or parameters themselves.

The $n$ is the order of the curve. Still missing is the co-factor $h$, but that's commonly set to the value 1 and may be left out for that particular reason. The seed can simply be ignored: it shows a random from which the values were derived. Other curves use a "nothing up my sleeves number" for this or avoid it altogether.

Generally libraries contain these parameters directly in source or within a resource. They often contain tables where you can retrieve the parameters (possibly in a library specific format) by supplying the named parameter as a string or an OID (object identifier).